PT-2007-2849 · Netenberg+1 · Fantastico+1

Published 2007-03-14 · Updated 2018-10-16 · CVE-2007-1455

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions cPanel versions 10.x

Description The issue concerns absolute path traversal vulnerabilities in Fantastico, used with cPanel. Remote authenticated users can exploit this to include and execute arbitrary local files. This can be achieved via the userlanguage parameter to "includes/load language.php" or the fantasticopath parameter to "includes/mysqlconfig.php" and certain other files.

Recommendations For cPanel version 10.x, consider restricting access to the includes/load language.php and includes/mysqlconfig.php files until a patch is available. As a temporary workaround, avoid using the userlanguage and fantasticopath parameters in the affected API endpoints.

Exploit

Fix

Related Identifiers

CVE-2007-1455

Affected Products

Fantastico

Cpanel

References · 6

• 🔥 https://exploit-db.com/exploits/3459 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-1455 · Security Note
• http://securityfocus.com/archive/1/462562/100/0/threaded · Note
• http://osvdb.org/35037 · Note
• http://osvdb.org/35036 · Note
• http://securityreason.com/securityalert/2420 · Note